Facebook Inc., Twitter Inc. and Alphabet Inc. collectively removed hundreds of accounts tied to an alleged Iranian propaganda operation on Tuesday, while Facebook took down a second campaign it said was linked to Russia.

Facebook CEO Mark Zuckerberg said the accounts identified on his company’s platform were part of two separate campaigns, the first from Iran with some ties to state-owned media, the second linked to sources which Washington has previously named as Russian military intelligence services.

Officials in Iran, where it is a holiday to mark the Muslim Eid al-Adha festival, were not immediately available to comment. Moscow has repeatedly denied using hacking or fake social media accounts to influence foreign elections. The Russian embassy in Washington did not immediately respond to a request for comment.

The move by Facebook and others is the latest attempt by global social media giants to guard against political interference on their platforms. It comes as concerns are rising about foreign attempts to disrupt the U.S. midterm elections in November.

The United States earlier this year indicted 13 Russians for alleged attempts to meddle in U.S. politics, but the latest alleged Iranian activity, exposed by cybersecurity firm FireEye Inc. suggests the problem may be more widespread.

“It really shows it’s not just Russia that engages in this type of activity,” Lee Foster, an information operations analyst with FireEye, told Reuters.

FireEye said the Iranian campaign used a network of fake news websites and fraudulent social media personas spread across Facebook, Instagram, Twitter, Google Plus and YouTube, to push narratives in line with Tehran’s interests.

The Iranian mission to the United Nations did not respond to a request for comment.

The activity was aimed at users in the United States, Britain, Latin America and Middle East up through this month, FireEye said, and included “anti-Saudi, anti-Israeli, and pro-Palestinian themes” as well as advocacy of policies favorable to Iran such as the U.S.-Iran nuclear deal.

FireEye said the Iranian activity did not appear “dedicated” to influencing the upcoming election, though some of the posts aimed at U.S. users did adopt “left-leaning identities” and took stances against President Donald Trump.

That activity “could suggest a more active attempt to influence domestic U.S. political discourse” is forthcoming, Foster said, but “we just haven’t seen that yet.”

‘DISTINCT CAMPAIGNS’

Facebook said the Russia-linked accounts it removed were engaged in “inauthentic behavior” related to politics in Syria and Ukraine. It said that activity did not appear to be linked to the Iranian campaign.

“These were distinct campaigns and we have not identified any link or coordination between them. However, they used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing,” the company said in a statement.

Facebook last month removed 32 pages and accounts tied to another misinformation campaign without describing its origins, but which U.S. lawmakers said likely had Russian involvement.

Microsoft said this week that hackers linked to the Russian government sought to steal email login credentials from U.S. politicians and think tanks, allegations the Russian foreign ministry described as a “witch-hunt.”

FireEye said the U.S.-focused Iranian activity ramped up last year, just months after Trump took office, with websites and social media accounts posting memes and articles, some of which were apparently copied from legitimate U.S. and Iranian news outlets.

In some cases, the domains for the fake websites like “US Journal” and “Liberty Free Press” were originally registered years before the 2016 election, in 2014 and 2013, but most remained inactive until last year, FireEye said.

Arabic-language, Middle East-focused websites appear to be part of the same campaign, the company added.

The technology companies variously said they linked the accounts to Iran based on user phone numbers, email addresses, website registration records and the timing of account activity matching Iranian business hours.

FireEye expressed “moderate confidence” about the Iranian origins, but said it has not been able to tie the accounts back to a specific organization or individuals.

Hundreds of thousands of people followed one or more of the Facebook pages implicated in the campaign, Facebook said.

It shared examples of removed posts, including a cartoon depicting an Israeli soldier executing a Palestinian and a fake movie poster showing President Trump embracing North Korean leader Kim Jong-un.

Postings cited by FireEye expressed praise for U.S. politicians and other Twitter users who criticized the Trump administration’s decision in May to abandon the Iranian nuclear pact, under which Iran had agreed to curb its nuclear weapons program in exchange for loosening of sanctions.

Some Twitter and Facebook accounts were designed to appear as if they were real people in the U.S., Britain and Canada, according to FireEye. The accounts used a combination of different hashtags to engage in U.S. culture, including “#lockhimup,” “#impeachtrump” and “notmypresident.”

Twitter, which called the effort “coordinated manipulation,” said it removed 284 accounts.

Facebook said it removed 254 pages and 392 accounts across its flagship platform as well as its Instagram service. Some of the accounts had events and groups associated with them.

The accounts spent about $12,000 to advertise through Facebook and Instagram using a variety of currencies, Facebook said. The company said it had notified the U.S. Treasury and State departments of the purchases, which may potentially violate sanctions.

Alphabet, which includes Google and YouTube, did not respond to a request to comment.

Creators of fake accounts and news pages on Facebook are learning from their past mistakes and making themselves harder to track and identify, posing new challenges in preventing the platform from being used for political misinformation, cyber security experts say.

This was apparent as Facebook tried to determine who created pages it said were aimed at sowing dissension among U.S. voters ahead of congressional elections in November. The company said on Tuesday it had removed 32 fake pages and accounts from Facebook and Instagram involved in what it called “coordinated inauthentic behavior.”

While the United States improves its efforts to monitor and root out such intrusions, the intruders keep getting better at it, said cyber security experts interviewed over the past two days.

Ben Nimmo, a senior fellow at the Washington-based Digital Forensic Research Lab, said he had noticed the latest pages used less original language, rather cribbing from copy already on the internet.

“Linguistic mistakes would give them away before, between 2014 and 2017,” Nimmo told Reuters. “In some of these newer cases it seems they’ve caught on to that by writing less (original material) when posting things. With their longer posts sometimes it’s just pirated, copy and pasted from some American website. That makes them less suspicious.”

Facebook’s prior announcement on the topic of fake accounts, in April, directly connected a Russian group known as the Internet Research Agency to a myriad of posts, events and propaganda that were placed on Facebook leading up to the 2016 U.S. presidential election.

This time, Facebook did not identify the source of the misinformation.

“It’s clear that whoever set up these accounts went to much greater lengths to obscure their true identities than the Russian-based Internet Research Agency (IRA) has in the past,” the company said in a blog post, https://newsroom.fb.com/news/2018/07/removing-bad-actors-on-facebook, on Tuesday, announcing the removal of the pages. “Our technical forensics are insufficient to provide high confidence attribution at this time.”

Facebook said it had shared evidence connected to the latest flagged posts with several private sector partners, including the Digital Forensic Research Lab, an organization founded by the Atlantic Council, a Washington think tank.

Facebook also said the use of virtual private networks, internet phone services, and domestic currency to pay for advertisements helped obfuscate the source of the accounts and pages. The perpetrators also used a third party, which Facebook declined to name, to post content.

Facebook declined to comment further, referring back to its blog post.

U.S. President Donald Trump’s top national security aides said on Thursday that Russia is behind “pervasive” attempts to interfere in November’s elections and that they expect attempts by Russia, and others, will continue into the 2020 elections.

They say they are concerned that attempts will be made to foment confusion and anger among various political groups in the United States and cause a distrust of the electoral process.

Two U.S. intelligence officials who requested anonymity told Reuters this week there was insufficient evidence to conclude that Russia was behind the latest Facebook campaign. However, one said “the similarities, aims and methodology relative to the 2016 Russian campaign are quite striking.”

‘PREVIOUS MISTAKES’

Experts who track online disinformation campaigns said the groups who launch such efforts have changed how they post content and create posts.

“These actors are learning from previous mistakes,” said John Kelly, chief executive of social media intelligence firm Graphika, adding they do not use the same internet addresses or pay in foreign currency.

“And as more players in the world learn these dark arts, it’s easier for them to hide among the multiple actors deploying the same playbook,” he said.

Philip Howard, an Oxford University professor of internet studies and director of the Oxford Internet Institute, said that suspicious social media accounts like those taken down this week were once more easily identifiable because they shared the same information from high-profile publications like RT, the Russian English-language news service, or Breitbart News Network.

But now, the content they often share is more diverse and less discernible, coming from lesser known sites, including internet forums that mix political news with other topics, he said.

“The junk news they’re sharing is using better quality images, for example, more believable domains, less-known websites, smaller blogs,” Howard added.

U.S. intelligence agencies have concluded that Russia meddled in the 2016 presidential campaign using tactics including fake Facebook accounts. The Internet Research Agency was one of three Russian companies charged in February by U.S. Special Counsel Robert Mueller with conspiracy to tamper with the 2016 election.

Moscow has denied any election interference.